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(57) Abstract: A demal-of-service atftck detecting system comprises a monitor device for monitoring a packet sent to a commu- 
nication device to come under a dertfal-of-servrce at^ck, a performance measuTTng device for measuTTng the performance of the 
communication device, and an atfcck decision device for communication with the monitor device and the performance measuring 
device. The monitor device detects traffic anomaly information indicating the anomaly of a traffic with a packet directed to the 
communication device. The performance measuTTng device detects performance anomgy information indicating the anomssy of the 
performance of the communication device. The attack decision device decides it on the basis of the traffic anomaly information and 
the performance anomaly information whether or not the attack is denial-of-service. 
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